CVE-2023-29863: Medical Systems Co.
Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files.
Published May 11, 2023 · Updated Jul 5, 2026
CVE archive
2023 CVE Archive
Browse CVE records published in 2023 CVE Archive, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 30600 matching CVEs · Page 7 of 612.
CVE-2023-25292: Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain...
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
Published Apr 27, 2023 · Updated Jul 5, 2026
CVE-2023-27775: A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary co...
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
Published Apr 12, 2023 · Updated Jul 5, 2026
CVE-2023-24317: Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the comp...
Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php.
Published Feb 23, 2023 · Updated Jul 5, 2026
CVE-2023-29820: An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local...
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is not a separate vulnerability relative to CVE-2023-29818 and CVE-2023-29819.
Published May 12, 2023 · Updated Jul 5, 2026
CVE-2023-49440: AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
Published Oct 27, 2025 · Updated Jul 5, 2026
CVE-2023-49367: An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive i...
An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent packages by user.
Published Sep 18, 2025 · Updated Jul 5, 2026
CVE-2023-44915: A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attacke...
A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
Published Jun 25, 2025 · Updated Jul 5, 2026
CVE-2023-36998: The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based...
The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.
Published Jan 22, 2025 · Updated Jul 5, 2026
CVE-2023-31493: RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log f...
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
Published Oct 15, 2024 · Updated Jul 5, 2026
CVE-2023-46948: A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a...
A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code via the skin parameter in the about.jsp and genrequest.jsp components.
Published Sep 23, 2024 · Updated Jul 5, 2026
CVE-2023-31729: TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
Published May 18, 2023 · Updated Jul 5, 2026
CVE-2023-31517: A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Se...
A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted file.
Published May 23, 2023 · Updated Jul 5, 2026
CVE-2023-27098: TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.
TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.
Published Jan 9, 2024 · Updated Jul 5, 2026
CVE-2023-27000: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute...
Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s).
Published Jan 9, 2024 · Updated Jul 5, 2026
CVE-2023-26999: An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause...
An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.
Published Jan 9, 2024 · Updated Jul 5, 2026
CVE-2023-26998: Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute...
Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.
Published Jan 9, 2024 · Updated Jul 5, 2026
CVE-2023-33413: The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard managemen...
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
Published Dec 7, 2023 · Updated Jul 5, 2026
CVE-2023-33412: The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (...
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
Published Dec 7, 2023 · Updated Jul 5, 2026
CVE-2023-33411: A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC)...
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
Published Dec 7, 2023 · Updated Jul 5, 2026
CVE-2023-24294: Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the com...
Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.
Published Nov 29, 2023 · Updated Jul 5, 2026
CVE-2023-33469: In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) a...
In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level.
Published Aug 9, 2023 · Updated Jul 5, 2026
CVE-2023-33468: KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability...
KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.
Published Aug 9, 2023 · Updated Jul 5, 2026
CVE-2023-30188: Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers t...
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
Published Aug 14, 2023 · Updated Jul 5, 2026
CVE-2023-30187: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote...
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Published Aug 14, 2023 · Updated Jul 5, 2026
CVE-2023-30186: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers...
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Published Aug 14, 2023 · Updated Jul 5, 2026
CVE-2023-27163: request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the compone...
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
Published Mar 31, 2023 · Updated Jul 5, 2026
CVE-2023-26979: Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle a...
Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication.
Published Aug 3, 2023 · Updated Jul 5, 2026
CVE-2023-26961: Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files.
Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.
Published Aug 8, 2023 · Updated Jul 5, 2026
CVE-2023-33668: DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and take...
DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.
Published Jul 12, 2023 · Updated Jul 5, 2026
CVE-2023-31825: An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the...
An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31824: An issue found in DERICIA Co.
An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31823: An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive...
An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Marui Official Store function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31822: An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information v...
An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31821: An issue found in ALBIS Co.
An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31820: An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive informatio...
An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31819: An issue found in KEISEI STORE Co, Ltd.
An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
Published Jul 13, 2023 · Updated Jul 5, 2026
CVE-2023-31818: An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information vi...
An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
Published Jul 11, 2023 · Updated Jul 5, 2026
CVE-2023-30383: TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Arche...
TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.
Published Jul 18, 2023 · Updated Jul 5, 2026
CVE-2023-26911: ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerabil...
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
Published Jul 26, 2023 · Updated Jul 5, 2026
CVE-2023-33438: A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attac...
A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML.
Published Jun 16, 2023 · Updated Jul 5, 2026
CVE-2023-31868: Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS).
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.
Published Jun 22, 2023 · Updated Jul 5, 2026
CVE-2023-31867: Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
Published Jun 22, 2023 · Updated Jul 5, 2026
CVE-2023-33532: There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48.
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.
Published Jun 6, 2023 · Updated Jul 5, 2026
CVE-2023-33530: There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1...
There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileges, they can inject commands gaining shell privileges.
Published Jun 6, 2023 · Updated Jul 5, 2026
CVE-2023-31748: Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via repl...
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.
Published May 24, 2023 · Updated Jul 5, 2026
CVE-2023-31742: There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006.
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
Published May 22, 2023 · Updated Jul 5, 2026
CVE-2023-31741: There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06.
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
Published May 23, 2023 · Updated Jul 5, 2026
CVE-2023-31740: There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06.
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.
Published May 23, 2023 · Updated Jul 5, 2026
CVE-2023-31595: IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
Published May 24, 2023 · Updated Jul 5, 2026